You could try editing the Powershell script that the SCOM Add on runs or as an alternative you could pull SCOM data from it's MS SQL DB into Splunk via DB Connect. I'm personally using the SCOM Add-on, but I don't have the same restraints on limiting how much pulls into Splunk. ... View more

Thanks for this info! After adding the attach.dll file to the jdk_home/bin location on our windows servers, I was now able to get the jmx logs to send to Splunk. I had to add it under the jdk/bin in addition to the jre/bin location. I'm still seeing a lot of errors in the jmx and splunkd logs, even though JMX data is sending. JMX.log 2017-10-19 08:56:50,243 - com.splunk.modinput.ModularInput -1788 [Thread-3] ERROR - Exception@checkConnector, e= java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: 10.0.0.1(IP Replaced); nested exception is: java.net.ConnectException: Connection refused: connect] at javax.management.remote.rmi.RMIConnector.connect(Unknown Source) at javax.management.remote.JMXConnectorFactory.connect(Unknown Source) at javax.management.remote.JMXConnectorFactory.connect(Unknown Source) at com.splunk.jmx.ServerTask.connect(Unknown Source) at com.splunk.jmx.ServerTask.checkConnector(Unknown Source) at com.splunk.jmx.Scheduler.run(Unknown Source) Caused by: javax.naming.ServiceUnavailableException [Root exception is java.rmi.ConnectException: Connection refused to host: 10.0.0.1; nested exception is: java.net.ConnectException: Connection refused: connect] at com.sun.jndi.rmi.registry.RegistryContext.lookup(Unknown Source) at com.sun.jndi.toolkit.url.GenericURLContext.lookup(Unknown Source) at javax.naming.InitialContext.lookup(Unknown Source) at javax.management.remote.rmi.RMIConnector.findRMIServerJNDI(Unknown Source) at javax.management.remote.rmi.RMIConnector.findRMIServer(Unknown Source) ... 6 more Caused by: java.rmi.ConnectException: Connection refused to host: 10.254.184.159; nested exception is: java.net.ConnectException: Connection refused: connect at sun.rmi.transport.tcp.TCPEndpoint.newSocket(Unknown Source) at sun.rmi.transport.tcp.TCPChannel.createConnection(Unknown Source) at sun.rmi.transport.tcp.TCPChannel.newConnection(Unknown Source) at sun.rmi.server.UnicastRef.newCall(Unknown Source) at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source) ... 11 more Caused by: java.net.ConnectException: Connection refused: connect at java.net.DualStackPlainSocketImpl.connect0(Native Method) at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source) at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source) at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source) at java.net.AbstractPlainSocketImpl.connect(Unknown Source) at java.net.PlainSocketImpl.connect(Unknown Source) at java.net.SocksSocketImpl.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at java.net.Socket.connect(Unknown Source) at java.net.Socket. (Unknown Source) at java.net.Socket. (Unknown Source) at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(Unknown Source) at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(Unknown Source) ... 16 more This error repeats in the splunkd.log file about 4 times every 10 seconds. 10-19-2017 09:03:12.626 -0500 ERROR ExecProcessor - message from "python "D:\Program Files\SplunkUniversalForwarder\etc\apps\us_ssloansvc_dev_jmx\bin\jmx.py"" [Fatal Error] :-1:-1: Premature end of file. ... View more

Thank you, this worked! You solved my regex dilemma. I just added this to the end to only show results that are over the normal length. | eval length=len(source) | search length>73 | table source count length ... View more

Figured out why it wasn't working. I had to modify my bat file to the following. @echo off for /f "tokens=2" %%i in ('tasklist ^| find "bwagent.exe"') DO echo %%i ... View more

I downvoted this post because this doesn't work. ... View more